1. Field of the Invention
The present invention is directed at the implementation of a dynamic wrapper for discovery of non-exported functions and subsequent method interception.
2. Description of the Prior Art and Related Information
The distributed component object model (DCOM) is a model providing access to distributed objects, usually on a network. DCOM defines the object interfaces. DCOM defines a remote procedure call protocol that allows objects to be run remotely over a network. DCOM was introduced in the operating system WINDOWS NT 4.0 by the Microsoft Corporation of Redmond Wash.
A service control manager (SCM) is a part of WINDOWS NT that launches background tasks. Developers can write executable programs that run under the control of the SCM. DCOM functions can similarly be written to run under the control of the SCM. Part of defining the functions to do so comprises having the function xe2x80x9cregisterxe2x80x9d itself with the SCM.
In object technology, including DCOM object technology, software applications include objects, which include methods or functions, which are called functions herein. Objects are the software building blocks of object technology. A function defines the processing that an object performs. DCOM clients access functions through the protocol defined within DCOM.
A software wrapper is a piece of code that is inserted into a target function at execution time. The execution behavior of the function is altered intentionally by the inserted wrapper code. Heretofore, since the wrapper does not have knowledge of the target function""s source code a priori, the wrapper can only access a target function""s publicly defined entry points. These entry points are normally established statically by the compiler and referred to as exported functions. The compiler generated program module contains embedded symbol information for exported functions that can be used by the wrapper at runtime. In contrast, non-exported functions have no compiler produced symbol information stored in the program module.
A DCOM system may be implemented on a DCOM server, which allows client computers to access exported functions having the publicly defined entry points on the DCOM server. Current software wrapper technology for DCOM software application programs revolves around interception of exported functions. Such systems are described in Matt Pietrek, xe2x80x9cLearn System-Level Win 32 Coding Techniques by Writing an API Spy Programxe2x80x9d, Microsoft Systems Journal, Vol 9 No Dec. 12, 1994, pp 17-44; Timothy Fraser, Lee Badger, and Mark Feldman, xe2x80x9cHardening COTS Software with Generic Software Wrappersxe2x80x9d, Proceedings of the 1999 IEEE Symposium on Security and Privacy, Oakland Calif., May 1999; and Robert Balzer and Neil Goldman, xe2x80x9cMediating Connectorsxe2x80x9d, Proceedings the 19th IEEE International Conference on Distributed Computing Systems Workshop, Austin, Tex. May 31-Jun. 5, 1999. In order for the wrapper code to intercept functions in given software module, a set of exported functions has to be explicitly declared at compile time. This approach works well with interception at kernel level application programming interfaces (API) which are the interfaces between applications and operating systems.
However, application software development has progressed toward a more object-oriented model where packaged modules have few explicitly exported functions. Conventional wrapper technology is unsuitable for such environments because of the lack of compiled symbol information.
There exist the need for a wrapping, or intercepting, technique that dynamically discovers non-exported functions for subsequent interception. The system and method of the present invention is referred to as a system of dynamic wrappers because the system does not rely on compiled symbol information. In one embodiment, the system of the present invention is used intercept functions of computer programs written as Microsoft DCOM executables.
The present invention defines a technology for dynamic wrappers for non-exported functions, allowing interception of non-exported functions in application software modules or functions. In order for a dynamic wrapper to understand and intercept software modules that have non-exported functions, the wrapper preferably should have intrinsic knowledge of the underlying protocol used by the intercepted modules. Therefore, one embodiment of the present invention is coupled with the Microsoft DCOM protocol and Windows NT operating system. Such a system may run on Microsoft Windows NT for the Intel x86 platform. However, DCOM interception may also run on other windowed operating systems and UNIX machines as well.
The design permits interception of DCOM client initiated method calls at the DCOM server during runtime. The interceptor of the method call denies or grants access to the DCOM method to be executed. The actual logic to determine access permissions need not be part of the interceptor. The interceptor runs as part of the DCOM server. It contains logic to distinguish at runtime the identity of the principal associated with the DCOM client requesting the execution of the function call. The technique works with commercial-off-the-shelf (COTS) software and does not require modification of the application source code.